diff --git a/packages/plugins/sandbox-providers/kubernetes/src/sandbox-cr-orchestrator.ts b/packages/plugins/sandbox-providers/kubernetes/src/sandbox-cr-orchestrator.ts
index 668286e3..b38062e5 100644
--- a/packages/plugins/sandbox-providers/kubernetes/src/sandbox-cr-orchestrator.ts
+++ b/packages/plugins/sandbox-providers/kubernetes/src/sandbox-cr-orchestrator.ts
@@ -152,8 +152,29 @@ export async function findPodForSandbox(
     return podName;
   }
 
-  // Fallback: list pods by the controller's sandbox-name label, which uniquely
-  // identifies the pod for THIS sandbox. A broader managed-by selector plus
+  // Secondary: the agent-sandbox controller (v0.4.x) names the backing pod
+  // EXACTLY after the Sandbox CR and labels it only with
+  // agents.x-k8s.io/sandbox-name-hash (a hash, not the full name), so the
+  // full-name label selector below matches nothing on that controller. An
+  // exact-name GET is collision-free (unlike name-prefix matching, which
+  // could hit a concurrent sandbox sharing a prefix) and resolves the pod on
+  // every controller version that keeps pod name == sandbox name.
+  try {
+    const pod = (await clients.core.readNamespacedPod({ namespace, name })) as {
+      metadata?: { name?: string };
+    };
+    if (pod?.metadata?.name) {
+      return pod.metadata.name;
+    }
+  } catch (err) {
+    const code =
+      (err as { code?: number; statusCode?: number }).code ??
+      (err as { code?: number; statusCode?: number }).statusCode;
+    if (code !== 404) throw err;
+  }
+
+  // Fallback: list pods by a full-name sandbox label, for controller versions
+  // that label pods with the sandbox name. A broader managed-by selector plus
   // name-prefix narrowing could match a concurrent sandbox whose generated
   // name shares a prefix, and exec would target the wrong lease's pod.
   const result = await clients.core.listNamespacedPod({
diff --git a/packages/plugins/sandbox-providers/kubernetes/test/unit/sandbox-cr-orchestrator.test.ts b/packages/plugins/sandbox-providers/kubernetes/test/unit/sandbox-cr-orchestrator.test.ts
index bdd25137..0237d941 100644
--- a/packages/plugins/sandbox-providers/kubernetes/test/unit/sandbox-cr-orchestrator.test.ts
+++ b/packages/plugins/sandbox-providers/kubernetes/test/unit/sandbox-cr-orchestrator.test.ts
@@ -101,16 +101,35 @@ describe("findPodForSandbox", () => {
     const get = vi.fn().mockResolvedValue(makeCr("Ready", "pc-abc-pod-xyz"));
     const clients = {
       custom: { getNamespacedCustomObject: get },
-      core: { listNamespacedPod: vi.fn() },
+      core: { readNamespacedPod: vi.fn(), listNamespacedPod: vi.fn() },
     };
     const podName = await findPodForSandbox(clients as never, "ns", "pc-abc");
     expect(podName).toBe("pc-abc-pod-xyz");
-    // Should NOT have called listNamespacedPod (primary path succeeded)
+    // Primary path succeeded: neither the exact-name GET nor the label list runs.
+    expect(clients.core.readNamespacedPod).not.toHaveBeenCalled();
     expect(clients.core.listNamespacedPod).not.toHaveBeenCalled();
   });
 
+  it("resolves the pod by EXACT NAME when the controller names it after the sandbox (v0.4.x: pods carry only agents.x-k8s.io/sandbox-name-hash, never the full-name label)", async () => {
+    const get = vi.fn().mockResolvedValue(makeCr("Ready")); // no podName in status
+    const read = vi.fn().mockResolvedValue({
+      metadata: { name: "pc-abc", labels: { "agents.x-k8s.io/sandbox-name-hash": "1a2b3c" } },
+      status: { phase: "Running" },
+    });
+    const list = vi.fn().mockResolvedValue({ items: [] }); // full-name label selector matches nothing on v0.4.x
+    const clients = {
+      custom: { getNamespacedCustomObject: get },
+      core: { readNamespacedPod: read, listNamespacedPod: list },
+    };
+    const podName = await findPodForSandbox(clients as never, "ns", "pc-abc");
+    expect(read).toHaveBeenCalledWith({ namespace: "ns", name: "pc-abc" });
+    expect(podName).toBe("pc-abc");
+    expect(list).not.toHaveBeenCalled();
+  });
+
   it("falls back to pod listing scoped by the unique sandbox-name label", async () => {
     const get = vi.fn().mockResolvedValue(makeCr("Pending")); // no podName
+    const read = vi.fn().mockRejectedValue({ code: 404 }); // no exact-name pod
     const list = vi.fn().mockResolvedValue({
       items: [
         {
@@ -121,7 +140,7 @@ describe("findPodForSandbox", () => {
     });
     const clients = {
       custom: { getNamespacedCustomObject: get },
-      core: { listNamespacedPod: list },
+      core: { readNamespacedPod: read, listNamespacedPod: list },
     };
     const podName = await findPodForSandbox(clients as never, "ns", "pc-abc");
     expect(list).toHaveBeenCalledWith(
@@ -143,18 +162,32 @@ describe("findPodForSandbox", () => {
     });
     const clients = {
       custom: { getNamespacedCustomObject: get },
-      core: { listNamespacedPod: list },
+      core: { readNamespacedPod: vi.fn().mockRejectedValue({ code: 404 }), listNamespacedPod: list },
     };
     const podName = await findPodForSandbox(clients as never, "ns", "pc-abc");
     expect(podName).toBeNull();
   });
 
+  it("propagates non-404 errors from the exact-name pod GET instead of falling through", async () => {
+    const get = vi.fn().mockResolvedValue(makeCr("Pending"));
+    const read = vi.fn().mockRejectedValue({ code: 403, message: "forbidden" });
+    const list = vi.fn();
+    const clients = {
+      custom: { getNamespacedCustomObject: get },
+      core: { readNamespacedPod: read, listNamespacedPod: list },
+    };
+    await expect(findPodForSandbox(clients as never, "ns", "pc-abc")).rejects.toMatchObject({
+      code: 403,
+    });
+    expect(list).not.toHaveBeenCalled();
+  });
+
   it("returns null when no pod is found in fallback", async () => {
     const get = vi.fn().mockResolvedValue(makeCr("Pending"));
     const list = vi.fn().mockResolvedValue({ items: [] });
     const clients = {
       custom: { getNamespacedCustomObject: get },
-      core: { listNamespacedPod: list },
+      core: { readNamespacedPod: vi.fn().mockRejectedValue({ code: 404 }), listNamespacedPod: list },
     };
     const podName = await findPodForSandbox(clients as never, "ns", "pc-abc");
     expect(podName).toBeNull();